350-401 Practice Exam 54 — 20 Questions

Question 1

Which THREE of the following are components of a Cisco ACI fabric? (Choose three.)

Accepted Answer

Spine switch. The spine switch is a core component of a Cisco ACI fabric, forming the spine-leaf topology. Spine switches provide high-speed, non-blocking connectivity between leaf switches and handle all east-west traffic, relying on IS-IS as the routing protocol for fabric discovery and forwarding.

Answer

Firewall

Answer

Router

Question 2

A network engineer is configuring a remote access VPN using Cisco AnyConnect on an ASA. The engineer wants to use certificate-based authentication. The ASA is configured with a CA server. After configuration, users can connect, but they are prompted for a username and password instead of using certificates. The engineer checks the ASA configuration and sees that the tunnel group has authentication method set to AAA. What should the engineer do to fix this?

Accepted Answer

Change the tunnel group authentication method to certificate.. The tunnel group authentication method determines how users are authenticated for the VPN connection. When set to AAA, the ASA prompts for a username and password, bypassing certificate-based authentication. Changing it to 'certificate' tells the ASA to use the client certificate for authentication, which matches the requirement for certificate-based authentication with AnyConnect.

Answer

Re-enroll the CA certificate on the ASA.

Answer

Change the connection profile to use the correct group.

Answer

Configure the group policy to require certificates.

Question 3

A company is deploying a new wireless network in a large warehouse. The network engineer must choose between using a centralized WLC architecture (with CAPWAP tunnels) or a converged access (SD-Access) wireless architecture. The warehouse has high-density client areas and requires low latency for real-time applications like voice and video. Which architecture should the engineer choose and why?

Accepted Answer

Converged access (SD-Access) wireless, because it allows local switching of traffic at the access layer, reducing latency.. Converged access (SD-Access) wireless enables local switching of traffic at the access layer, which eliminates the need to hairpin traffic through a centralized WLC. This reduces latency significantly, which is critical for real-time applications like voice and video in high-density warehouse environments. Centralized CAPWAP tunnels would add unnecessary delay by forcing all traffic back to the WLC.

Answer

Centralized WLC architecture, because it provides better RF management and security.

Answer

Centralized WLC architecture, because it requires fewer access points to cover the warehouse.

Answer

Converged access (SD-Access) wireless, because it requires fewer WLCs to manage the network.

Question 4

A network engineer is configuring BGP on a router that will be used for BGP route summarization. The router receives multiple more-specific prefixes from its eBGP peers. The engineer wants to advertise a summary route to the iBGP peers without advertising the more-specific routes. Which command should the engineer use to suppress the more-specific routes while still installing them in the local routing table?

Accepted Answer

Use the 'aggregate-address' command with the 'summary-only' keyword.. The 'aggregate-address' command with the 'summary-only' keyword in BGP creates a summary route from more-specific prefixes and suppresses the advertisement of those more-specific routes to BGP peers, while still keeping them in the local routing table. This meets the requirement of advertising only the summary to iBGP peers without removing the more-specific routes from the router's own RIB.

Answer

Use the 'network' command to advertise the summary route.

Answer

Use the 'summary-address' command under the BGP address family.

Answer

Use the 'redistribute' command to inject the summary route into BGP.

Question 5

A company uses Cisco NFVIS to host a virtual ASA (vASA) and a virtual router (vRouter). The engineer notices that the vASA cannot communicate with the vRouter even though both are on the same NFVIS host. The vASA is connected to a bridge network, and the vRouter is connected to a different bridge. What should the engineer do to enable communication between the two VNFs?

Accepted Answer

Create a new bridge that connects both VNFs, or use a virtual switch to route between the bridges.. In NFVIS, VNFs attached to different bridge networks are isolated at Layer 2. To enable communication between them, you must either create a new bridge that connects both VNFs or use a virtual switch (e.g., a Linux bridge with routing enabled) to forward traffic between the two bridges. This allows the VNFs to share a common Layer 2 domain or have a routed path through the hypervisor.

Answer

Connect a physical cable between two ports on the NFVIS host.

Answer

Configure VLAN tagging on both VNFs with the same VLAN ID.

Answer

Add a static route on each VNF pointing to the other VNF's IP address.

Question 6

Match each QoS feature to its description.

Accepted Answer

Classification: Identifying and categorizing packets based on criteria such as IP precedence or DSCP.. Correct matches: Classification (A), Marking (B), Policing (C), Queuing (F). Common confusions: Shaping vs. Congestion Avoidance (WRED), where Shaping buffers and WRED drops early.

Answer

Shaping: Dropping packets early when congestion is anticipated to avoid tail drop.

Answer

Congestion Avoidance: Smoothing traffic to fit within a desired rate by buffering excess packets.

Question 7

Drag and drop the steps of SD-WAN policy creation and push via vManage into the correct order, from first to last.

Accepted Answer

Administrator defines policy in vManage GUI. Policy creation begins with defining the policy in vManage, then attaching it to a group of devices, after which vManage pushes the policy to vSmart, vSmart translates it into OMP updates, and finally the edge devices receive and enforce the policy.

Question 8

What is the default CoS-to-queue mapping on a Cisco switch that supports QoS?

Accepted Answer

CoS 0-1 to queue 1, CoS 2-3 to queue 2, CoS 4-5 to queue 3, CoS 6-7 to queue 4. On Cisco switches that support QoS, the default Class of Service (CoS) to queue mapping distributes CoS values across four egress queues. CoS 0 and 1 are mapped to queue 1 (best effort), CoS 2 and 3 to queue 2, CoS 4 and 5 to queue 3, and CoS 6 and 7 to queue 4 (highest priority). This mapping is defined by the default trust state and is used to prioritize traffic based on the 802.1p priority bits in the VLAN tag.

Answer

CoS 0-2 to queue 1, CoS 3-5 to queue 2, CoS 6-7 to queue 3

Answer

CoS 0 to queue 1, CoS 1 to queue 2, CoS 2 to queue 3, CoS 3 to queue 4

Answer

All CoS values are mapped to a single queue by default.

Question 9

Examine the CoPP configuration:

class-map match-any COPP_SSH
 match access-group name SSH_ACL
!
policy-map COPP_POLICY
 class COPP_SSH
  police 10000 conform-action transmit exceed-action drop
 class class-default
  police 5000 conform-action transmit exceed-action drop
!
control-plane
 service-policy input COPP_POLICY

Which statement is true?

Accepted Answer

SSH traffic is limited to 10 kbps; all other control plane traffic is limited to 5 kbps.. The CoPP policy explicitly matches SSH traffic via the COPP_SSH class and applies a police rate of 10,000 bps (10 kbps) to it. All other control plane traffic falls into class-default, which is policed at 5,000 bps (5 kbps). The 'conform-action transmit exceed-action drop' ensures that traffic exceeding these rates is dropped, so SSH is limited to 10 kbps and all other control plane traffic to 5 kbps.

Answer

All control plane traffic is limited to 10 kbps.

Answer

The class-default police rate is ignored because it is not explicitly matched.

Answer

The policy-map should be applied to an interface, not the control plane.

Question 10

A network engineer is configuring EtherChannel between two Cisco switches using LACP. The engineer wants to ensure that if fewer than two links are operational, the EtherChannel does not come up. Which command should be configured?

Accepted Answer

Configure 'port-channel min-links 2' under the port-channel interface.. The 'port-channel min-links' command configures the minimum number of active member links required for the EtherChannel to become operational. When set to 2, the port-channel will not come up unless at least two links are active, meeting the engineer's requirement. This feature is supported by both LACP and PAgP, but is specifically configured under the port-channel interface.

Answer

Configure 'lacp min-bundle 2' under the port-channel interface.

Answer

Configure 'channel-group 1 mode active' on the physical ports.

Answer

Configure 'port-channel max-links 2' under the port-channel interface.

Question 11

A network engineer runs the following command on Router R5:

R5# show mpls ldp discovery
 Local LDP Identifier: 10.5.5.5:0
 Discovery Sources:
   Interfaces:
     GigabitEthernet0/0: xmit/recv
       LDP Id: 10.5.5.4:0, no hello (expired)
     GigabitEthernet0/1: xmit/recv
       LDP Id: 10.5.5.6:0

Based on this output, what is the state of the LDP session with neighbor 10.5.5.4?

Accepted Answer

The LDP session with 10.5.5.4 is not established because no hello messages have been received from that neighbor.. The output shows 'no hello (expired)' for the LDP neighbor 10.5.5.4, indicating that hello messages from that neighbor have not been received within the hello hold time. LDP sessions are established only after both routers exchange hello messages; without receiving hellos, the session cannot be formed. The 'xmit/recv' state on the interface means the router is transmitting and capable of receiving hellos, but the expired hello from the neighbor confirms the session is down.

Answer

The LDP session with 10.5.5.4 is operational because the interface is in xmit/recv mode.

Answer

The LDP session with 10.5.5.4 is down because the interface is not operational.

Answer

The LDP session with 10.5.5.4 is using targeted discovery.

Question 12

Given this configuration:
interface GigabitEthernet0/0
 ip address 172.16.1.1 255.255.255.0
 ip pim sparse-mode
!
interface GigabitEthernet0/1
 ip address 172.16.2.1 255.255.255.0
 ip pim sparse-mode
!
ip pim rp-address 172.16.1.1

What is the effect of this configuration?

Accepted Answer

The router uses 172.16.1.1 as the RP for all multicast groups, and PIM sparse-mode is enabled on both interfaces.. The configuration statically assigns 172.16.1.1 as the RP for all multicast groups using the 'ip pim rp-address' command, and both interfaces are explicitly configured with 'ip pim sparse-mode'. This ensures that PIM sparse-mode is operational on the interfaces and that the router uses the specified RP for group-to-RP mapping, making option A correct.

Answer

The router will automatically elect an RP using BSR because no RP is configured.

Answer

PIM dense-mode is used because sparse-mode is not fully configured.

Answer

The configuration is invalid because the RP address must be a loopback interface.

Question 13

A network engineer runs the following command on a Cisco WLC:

WLC# show ap inventory all

AP Inventory Information
-----------------------
AP Name: AP-1
Base MAC: aabb.cc00.0100
Model: AIR-CAP3702I-A-K9
Software: 8.5.151.0

AP Name: AP-2
Base MAC: aabb.cc00.0200
Model: AIR-AP2802I-B-K9
Software: 8.5.151.0

AP Name: AP-3
Base MAC: aabb.cc00.0300
Model: AIR-AP3802I-A-K9
Software: 8.5.151.0

Based on this output, what can be concluded?

Accepted Answer

All APs are running the same software version and are compatible with the WLC.. The output shows all three APs (AIR-CAP3702I-A-K9, AIR-AP2802I-B-K9, AIR-AP3802I-A-K9) are running software version 8.5.151.0, which is a valid Cisco IOS-XE release for the WLC. All listed models are lightweight (CAPWAP-based) APs that are compatible with a Cisco WLC running the same major code train. The WLC can manage mixed-model APs as long as they are supported in its software release, and version 8.5.151.0 supports these 3700, 2800, and 3800 series APs.

Answer

AP-1 is a lightweight AP and AP-2 and AP-3 are autonomous APs.

Answer

AP-3 has a hardware failure because its model is different.

Answer

The WLC is running a software version that only supports AP-2 and AP-3.

Question 14

Examine the following SD-WAN policy configuration on a Cisco vSmart controller:

policy
 control-policy CONTROL_POLICY
 sequence 10
 match route
 prefix-list PL_10
 action accept
 set
 community 100:10
!
 prefix-list PL_10
 sequence 10
 match ip-address 10.0.0.0/24
!

What is the effect of this control policy?

Accepted Answer

The policy matches routes with prefix 10.0.0.0/24 and sets the community value 100:10 on those routes before advertising them via OMP.. This control policy matches OMP routes that have the prefix 10.0.0.0/24 (as defined by the prefix-list PL_10) and, upon a match, sets the community value 100:10 on those routes. The action 'accept' means the route is permitted and the 'set community' modifies the route's attributes before it is advertised via OMP to other vSmart or vEdge devices. This is a standard SD-WAN control policy operation for manipulating route attributes within the overlay.

Answer

The policy matches routes with prefix 10.0.0.0/24 and sets the community 100:10 on the local router's routing table.

Answer

The policy denies all routes except 10.0.0.0/24 and sets community 100:10.

Answer

The policy is invalid because prefix-list names cannot contain underscores.

Question 15

Given this NAT configuration:
```
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 ip nat outside
!
ip nat inside source static 10.0.0.5 198.51.100.5
```
What is the purpose of this configuration?

Accepted Answer

It creates a one-to-one mapping between 10.0.0.5 and 198.51.100.5, allowing inbound and outbound traffic.. The configuration uses the 'ip nat inside source static' command to create a permanent one-to-one mapping between the inside local address 10.0.0.5 and the inside global address 198.51.100.5. This static NAT allows both outbound traffic (source translation) and inbound traffic (destination translation) to and from the mapped host, enabling bidirectional communication without the need for an access list.

Answer

It translates all traffic from 10.0.0.0/24 to 198.51.100.0/24 using PAT.

Answer

It translates only outbound traffic from 10.0.0.5 to 198.51.100.5.

Answer

The configuration is incomplete; it needs an access-list.

Question 16

An enterprise is redesigning its WAN QoS architecture to support real-time voice, video, and critical data applications over a limited bandwidth link. The architect must ensure that voice traffic receives strict priority queuing and that video traffic is guaranteed a minimum bandwidth, while allowing best-effort traffic to use remaining capacity. Which queuing strategy should be deployed on the WAN edge routers?

Accepted Answer

LLQ (Low Latency Queuing) with a strict priority queue for voice and CBWFQ for video and data. LLQ combines a strict priority queue for delay-sensitive voice traffic with CBWFQ for other classes, guaranteeing minimum bandwidth for video while allowing best-effort traffic to share remaining capacity. This satisfies the requirement for strict priority queuing for voice and bandwidth guarantees for video, which CBWFQ alone cannot provide because it lacks a priority queue.

Answer

FIFO (First In, First Out) with tail drop

Answer

CBWFQ (Class-Based Weighted Fair Queuing) without a priority queue

Answer

WRED (Weighted Random Early Detection) with DSCP-based drop probabilities

Question 17

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Accepted Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop. It uses the 'match protocol ssh' class-map to identify SSH traffic, applies a police rate of 1,000,000 bps (1 Mbps) with a burst of 2000 bytes, and includes a class-default with a police rate of 8000 bps to drop all other control-plane traffic exceeding a default rate. This matches the requirement to rate-limit SSH and drop other traffic that exceeds a default rate, which is a common CoPP best practice to protect the control plane.

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match access-group name SSH_ACL
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 2000 1000000 conform-action transmit exceed-action drop

Question 18

A network engineer issues the following command on Router R8:

R8# show policy-map interface gigabitethernet 0/1
 GigabitEthernet0/1

Service-policy output: SHAPE-1M
    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any
      queue limit 64 packets
      (queue depth 0)
      (congestion occurrences)
      shape (average) cir 1000000, bc 10000, be 10000
      target shape rate 1000000

Based on this output, what is true about the traffic shaping policy?

Accepted Answer

The policy is shaping traffic to an average rate of 1 Mbps.. The output shows 'shape (average) cir 1000000', which configures traffic shaping to an average rate of 1 Mbps. Shaping buffers excess traffic and smooths it out over time, unlike policing which drops or marks packets. The 'target shape rate 1000000' confirms the shaped rate is 1 Mbps.

Answer

The policy is policing traffic to 1 Mbps.

Answer

The policy is dropping all traffic because the queue is full.

Answer

The policy is applied in the input direction.

Question 19

An engineer is configuring a new Cisco 9800 WLC in a branch office. The WLC will manage 50 APs and must provide guest access with a captive portal. The engineer configures a guest SSID with open authentication and a redirect ACL for the captive portal. However, after the configuration, clients can associate to the guest SSID but cannot reach the captive portal page. What is the most likely cause?

Accepted Answer

The redirect ACL is missing entries for DNS and HTTP traffic to the captive portal server.. The redirect ACL is used to permit traffic that should bypass the captive portal (e.g., DNS and HTTP traffic to the captive portal server) while redirecting all other HTTP traffic. If the ACL is missing entries for DNS and HTTP to the portal server, the client's DNS lookup for the portal server or the initial HTTP request to it will be redirected instead of allowed, causing the captive portal page to fail to load. This is a common misconfiguration on Cisco 9800 WLCs, where the redirect ACL must explicitly permit the necessary traffic to the portal server.

Answer

The guest SSID is configured with open authentication, which does not support captive portal.

Answer

The WLC does not have a dedicated guest interface configured.

Answer

The captive portal requires a RADIUS server to be configured on the WLC.

Question 20

A network engineer runs the following command on switch SW5:

SW5# show cts sxp connections

SXP Connections:

Peer IP         Source IP        Conn Status     Duration
10.1.1.1        10.1.1.2        Up              2d3h
10.1.1.3        10.1.1.2        Down            0d0h

Based on this output, what can be concluded?

Accepted Answer

The SXP connection to 10.1.1.1 has been up for 2 days and 3 hours.. The command 'show cts sxp connections' displays the status of SXP (Security Group Tag Exchange Protocol) connections. The output shows that the connection to peer 10.1.1.1 has a status of 'Up' and a duration of '2d3h', meaning it has been established for 2 days and 3 hours. Option B correctly identifies this fact.

Answer

Both SXP connections are operational.

Answer

The switch is using 802.1X for authentication.

Answer

The SXP connection to 10.1.1.3 is up.